Zircuit Finance - Merkle Distributor

QuantstampCode version: not recorded (see the report)

Audit

Quantstamp reviewed Zircuit (Zircuit Finance - Merkle Distributor) on 7 Sep 2026: 1 finding, 0 critical; it is acknowledged, not fixed.

No open critical findings
Open the reportOpen Zircuit’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings1

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low010
LowIdentical Period Distributions Could Collide on the Same Merkle RootAcknowledged

In `MerkleDistributor`, `leafHash()` commits no distribution identifier, so periods with identical entitlement sets produce the same root and share `claimed` state. `setMerkleRoot()` rejects the repeated root, while the referral synchronization flow reports it as enabled. Prior claimants cannot receive the later payout, and other accounts can receive at most one payout across both periods.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Zircuit’s security record

Zircuit
Audits4 audits by 1 firmLast audit Sep 2026, by Quantstamp.
Critical findingsNo open critical findingsAcross 4 reports.
Open Zircuit’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us